In practice, \(\ell ^{attack}\)  can be the cross-entropy (for discrete input) or squared-loss (for continuous-valued input) function and we find that using a multi-layer perceptron (MLP) [1]} for \(g_{\theta }\)  is effective empirically. Importantly, when a defense mechanism such as gradient perturbation or gradient compression is applied, we can apply the same transformation to \(\nabla _{\mathbf {w}}\ell (f_{\mathbf {w}}(\mathbf {x}_{\rm aux}), y_{\rm aux})\)  to augment the training data for \(g_\theta \)  to carry out an adaptive attack. We will show in sec:exp that this simple approach is surprisingly effective at circumventing existing defenses.
